Skip to content

docs(readme): add standardized status & security badges - #156

Open
ashu-tosh-kumar wants to merge 1 commit into
developmentfrom
chore/standardize-badges
Open

docs(readme): add standardized status & security badges#156
ashu-tosh-kumar wants to merge 1 commit into
developmentfrom
chore/standardize-badges

Conversation

@ashu-tosh-kumar

Copy link
Copy Markdown
Owner

Adds the standardized README badge set as part of cross-repo SDLC standardization.

Badges added

  • License + OpenSSF Scorecard (core, every repo)
  • Project-type-specific badges (PyPI version/downloads, CI status, code style, browser-store metrics, etc. as applicable)

Note

  • The OpenSSF Scorecard badge populates a score once the Scorecard workflow has run on the default branch (i.e. after the security-baseline PR is merged).
  • The OpenSSF Best Practices badge is left as a commented-out placeholder — it needs the repo registered at https://www.bestpractices.dev/en/projects/new first, then swap PROJECT_ID and uncomment.

🤖 Generated with Claude Code

Add the standardized README badge set (license, OpenSSF Scorecard, plus
project-type-specific badges). OpenSSF Best Practices badge left as a commented
placeholder pending project registration at bestpractices.dev.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@qodo-code-review

Copy link
Copy Markdown

PR Summary by Qodo

docs(readme): add standardized status & security badges

📝 Documentation 🕐 Less than 5 minutes

Grey Divider

AI Description

• Add CI, OpenSSF Scorecard, Black, and pre-commit badges to the README header.
• Keep OpenSSF Best Practices badge as a commented placeholder pending project registration.
• Standardize badge styling via flat-square shields.io parameters.
High-Level Assessment

The following are alternative approaches to this PR:

1. Use reference-style Markdown links for badges
  • ➕ Reduces visual noise at the top of README by moving long URLs to the bottom
  • ➕ Easier to update badge URLs/params consistently
  • ➖ Slightly less immediately readable in raw README source
  • ➖ Requires reformatting existing badges for consistency

Recommendation: Current approach is fine for a small README and matches common OSS conventions. If the badge set will continue to grow or be standardized across multiple repos, consider converting to reference-style links to keep the README header maintainable.

Files changed (1) +5 / -0

Documentation (1) +5 / -0
README.mdAdd standardized CI/security/tooling badges +5/-0

Add standardized CI/security/tooling badges

• Adds shields.io badges for CI status, OpenSSF Scorecard, Black code style, and pre-commit enablement. Includes a commented OpenSSF Best Practices badge placeholder with registration instructions.

README.md

@qodo-code-review

Copy link
Copy Markdown

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: build3_9

Failed stage: Install dependencies [❌]

Failed test name: ""

Failure summary:

The workflow failed during Poetry dependency resolution because the job is using Python 3.9.25, but
the dependency poetry-plugin-export (required as ^1.10.0) requires Python >=3.10,<4.0.
- Error shown at
lines 321-325: Poetry reports the project's supported Python range is 3.9.25, which is incompatible
with poetry-plugin-export, so version solving fails.
- The step exits with code 1 (line 330),
causing the action to fail.

Relevant error logs:
1:  ##[group]Runner Image Provisioner
2:  Hosted Compute Agent
...

106:  git switch -
107:  Turn off this advice by setting config variable advice.detachedHead to false
108:  HEAD is now at 3ca72fa Merge e6f8352b79b7ee6d6674bbe4481bc414afec9de8 into 18535854eeadb37954ce4d30b66ab59e850b12a6
109:  ##[endgroup]
110:  [command]/usr/bin/git log -1 --format=%H
111:  3ca72fa59a59facbe39eb2d511c5ed0b3a92e8ea
112:  Node 20 is being deprecated. This workflow is running with Node 24 by default. If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
113:  ##[group]Run actions/setup-python@v3
114:  with:
115:  python-version: 3.9
116:  token: ***
117:  ##[endgroup]
118:  Version 3.9 was not found in the local cache
119:  (node:2274) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
120:  (Use `node --trace-deprecation ...` to show where the warning was created)
121:  (node:2274) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
122:  Version 3.9 is available for downloading
...

310:  Downloading jaraco.classes-3.4.0-py3-none-any.whl (6.8 kB)
311:  Downloading jaraco_context-6.1.1-py3-none-any.whl (7.0 kB)
312:  Downloading backports.tarfile-1.2.0-py3-none-any.whl (30 kB)
313:  Downloading jaraco_functools-4.4.0-py3-none-any.whl (10 kB)
314:  Downloading more_itertools-10.8.0-py3-none-any.whl (69 kB)
315:  Downloading pycparser-2.23-py3-none-any.whl (118 kB)
316:  Installing collected packages: trove-classifiers, fastjsonschema, distlib, zstandard, zipp, urllib3, typing_extensions, tomlkit, tomli, shellingham, rapidfuzz, pyproject-hooks, pycparser, poetry-core, platformdirs, pkginfo, pbs-installer, packaging, msgpack, more-itertools, jeepney, installer, idna, h11, filelock, crashtest, charset_normalizer, certifi, backports.tarfile, requests, python-discovery, jaraco.functools, jaraco.context, jaraco.classes, importlib-metadata, httpcore, findpython, exceptiongroup, dulwich, cleo, cffi, virtualenv, requests-toolbelt, cryptography, cachecontrol, build, anyio, SecretStorage, httpx, keyring, poetry
317:  Successfully installed SecretStorage-3.3.3 anyio-4.12.1 backports.tarfile-1.2.0 build-1.4.4 cachecontrol-0.14.3 certifi-2026.6.17 cffi-2.0.0 charset_normalizer-3.4.7 cleo-2.1.0 crashtest-0.4.1 cryptography-49.0.0 distlib-0.4.3 dulwich-0.24.10 exceptiongroup-1.3.1 fastjsonschema-2.21.2 filelock-3.19.1 findpython-0.7.1 h11-0.16.0 httpcore-1.0.9 httpx-0.28.1 idna-3.18 importlib-metadata-8.7.1 installer-0.7.0 jaraco.classes-3.4.0 jaraco.context-6.1.1 jaraco.functools-4.4.0 jeepney-0.9.0 keyring-25.7.0 more-itertools-10.8.0 msgpack-1.1.2 packaging-26.2 pbs-installer-2025.12.17 pkginfo-1.12.1.2 platformdirs-4.4.0 poetry-2.2.1 poetry-core-2.2.1 pycparser-2.23 pyproject-hooks-1.2.0 python-discovery-1.4.2 rapidfuzz-3.13.0 requests-2.32.5 requests-toolbelt-1.0.0 shellingham-1.5.4 tomli-2.4.1 tomlkit-0.15.0 trove-classifiers-2026.6.1.19 typing_extensions-4.15.0 urllib3-2.6.3 virtualenv-21.5.1 zipp-3.23.1 zstandard-0.25.0
318:  Using version ^1.10.0 for poetry-plugin-export
319:  Updating dependencies
320:  Resolving dependencies...
321:  The current project's supported Python range (3.9.25) is not compatible with some of the required packages Python requirement:
322:  - poetry-plugin-export requires Python <4.0,>=3.10, so it will not be installable for Python 3.9.25
323:  Because poetry-plugin-export (1.10.0) requires Python <4.0,>=3.10
324:  and no versions of poetry-plugin-export match >1.10.0,<2.0.0, poetry-plugin-export is forbidden.
325:  So, because poetry-instance depends on poetry-plugin-export (^1.10.0), version solving failed.
326:  * Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
327:  For poetry-plugin-export, a possible solution would be to set the `python` property to "<empty>"
328:  https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
329:  https://python-poetry.org/docs/dependency-specification/#using-environment-markers
330:  ##[error]Process completed with exit code 1.
331:  Node 20 is being deprecated. This workflow is running with Node 24 by default. If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds several new badges (CI, OpenSSF Scorecard, Code style: black, and pre-commit) to the README.md file. The reviewer pointed out a visual inconsistency where the new badges use the 'flat-square' style while the existing ones use the default rounded style, and provided a suggestion to unify them.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment thread README.md
Comment on lines +9 to +12
[![CI](https://img.shields.io/github/actions/workflow/status/ashu-tosh-kumar/todo_notifier/python-app.yml?style=flat-square&label=CI)](https://github.com/ashu-tosh-kumar/todo_notifier/actions/workflows/python-app.yml)
[![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/ashu-tosh-kumar/todo_notifier?style=flat-square&label=openssf%20scorecard)](https://scorecard.dev/viewer/?uri=github.com/ashu-tosh-kumar/todo_notifier)
[![Code style: black](https://img.shields.io/badge/code%20style-black-000000?style=flat-square)](https://github.com/psf/black)
[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?style=flat-square&logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The newly added badges use the flat-square style (e.g., ?style=flat-square), whereas the existing badges (PyPI, Python Support, License, Downloads) use the default flat style (rounded corners). Mixing these styles creates a visual inconsistency in the badge section.\n\nTo maintain a consistent look, consider removing the style=flat-square parameter from the new badges so they match the default style of the existing ones.

Suggested change
[![CI](https://img.shields.io/github/actions/workflow/status/ashu-tosh-kumar/todo_notifier/python-app.yml?style=flat-square&label=CI)](https://github.com/ashu-tosh-kumar/todo_notifier/actions/workflows/python-app.yml)
[![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/ashu-tosh-kumar/todo_notifier?style=flat-square&label=openssf%20scorecard)](https://scorecard.dev/viewer/?uri=github.com/ashu-tosh-kumar/todo_notifier)
[![Code style: black](https://img.shields.io/badge/code%20style-black-000000?style=flat-square)](https://github.com/psf/black)
[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?style=flat-square&logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
[![CI](https://img.shields.io/github/actions/workflow/status/ashu-tosh-kumar/todo_notifier/python-app.yml?label=CI)](https://github.com/ashu-tosh-kumar/todo_notifier/actions/workflows/python-app.yml)\n[![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/ashu-tosh-kumar/todo_notifier?label=openssf%20scorecard)](https://scorecard.dev/viewer/?uri=github.com/ashu-tosh-kumar/todo_notifier)\n[![Code style: black](https://img.shields.io/badge/code%20style-black-000000)](https://github.com/psf/black)\n[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)

@qodo-code-review

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Grey Divider

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Grey Divider

Qodo Logo

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant